# StreamGrants

A set of permissions to grant on a Table Stream.

- Source: [`aws-dynamodb/lib/stream-grants.ts`](https://github.com/aws/aws-cdk/blob/v2.275.0/packages/aws-cdk-lib/aws-dynamodb/lib/stream-grants.ts#L36)
- Type last changed: v2.227.0 · 21 Nov 2025

## Example

```ts
// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
import { aws_dynamodb as dynamodb } from 'aws-cdk-lib';
import { aws_kms as kms } from 'aws-cdk-lib';
import { aws_dynamodb as interfaces_dynamodb } from 'aws-cdk-lib/interfaces';

declare const key: kms.Key;
declare const tableRef: interfaces_dynamodb.ITableRef;
const streamGrants = new dynamodb.StreamGrants({
  tableStreamArn: 'tableStreamArn',

  // the properties below are optional
  encryptionKey: key,
  table: tableRef,
});
```

## Initializer

```ts
new StreamGrants(props: StreamGrantsProps)
```

## Methods

- `actions(grantee: IGrantable, ...actions: string[]): Grant` — Adds an IAM policy statement associated with this table's stream to an IAM principal's policy.

  If `encryptionKey` is present, appropriate grants to the key needs to be added
  separately using the `table.encryptionKey.grant*` methods.

  **Parameters**

  - `grantee` — The principal (no-op if undefined).
  - `actions` — The set of actions to allow (i.e. "dynamodb:DescribeStream", "dynamodb:GetRecords", ...).

- `list(grantee: IGrantable): Grant` — Permits an IAM Principal to list streams attached to current dynamodb table.

  **Parameters**

  - `grantee` — The principal (no-op if undefined).

- `read(grantee: IGrantable): Grant` — Permits an IAM principal all stream data read operations for this table's stream: DescribeStream, GetRecords, GetShardIterator, ListStreams.

  Appropriate grants will also be added to the customer-managed KMS key
  if one was configured.

  **Parameters**

  - `grantee` — The principal to grant access to.